|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:05:18:00 | WinXP | 203.117.61.234 (-): JDPOWER, SINGAPORE, SINGAPORE, SG. (100Mbps) |
203.117.61.234:50886 | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
39 of 43 | 4410d5ed68 NEW |
none[none] | none:none |
none|none | none | none |
| T:05:37:00 | WinXP | 178.90.15.194 (FINEBLANK.COM): EU-ZZ, UK. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 43 | 95d1a78f0d NEW |
none[none] | none:none |
none|none | none | none | |
| T:05:58:00 | WinXP | 151.83.184.247 (SER-PR2-MAX.IUNET.IT): INFOSTRADA, IT. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:10:25:00 | WinXP | 196.201.88.47 (PLT2-10.AVISO.CI): ISP COTE D'IVOIRE, CI. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:11:47:00 | WinXP | 75.56.19.180 (SBCGLOBAL.NET): TAPATIO BROTHERS, PLANO, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:13:17:00 | WinXP | 87.5.187.247 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA S.P.A. TIN EASY LITE, PADOVA, VENETO, IT. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 43 | bcf30127be NEW |
none[none] | none:none |
none|none | none | none |
| T:14:14:00 | WinXP | 174.39.168.139 (WINDSTREAM.NET): ALLTEL MIP CUSTOMERS - OMAHA, NORTH PLATTE, NEBRASKA, US. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | d11b1f56f9 NEW |
none[none] | none:none |
none|none | none | none | |
| T:18:37:00 | WinXP | 99.167.106.34 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, HAMDEN, CONNECTICUT, US. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 NEW |
none[0] | none:none |
none|none | lines=60 | trace | |
| 18:44:00 | Win2K-f | 125.16.62.215 (-): MPLX-182225-NEWDELHI, DELHI, DELHI, IN. (100Mbps) |
n/a | US:www.maxmind.com :www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com EU:checkip.dyndns.org DE:131.220.6.26:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| 20:33:00 | Win2K-f | 218.63.110.225 (163DATA.COM.CN): CHINANET YUNNAN PROVINCE NETWORK, BEIJING, BEIJING, CN. (DIAL) |
n/a | US:www.maxmind.com EU:checkip.dyndns.org :www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com DE:131.220.6.26:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |